Questions tagged [web-application]

An application that is accessed over a network such as the Internet or an intranet using a browser.

Filter by
Sorted by
Tagged with
0
votes
0answers
8 views

owasp crs 3.0 rule functuonalityconsult

I have built a waf and using CRS 3.0, this waf can inspect the request body to limit the file size that upload to the server, I am wondering ,if I just disable this feature manually, it will cause any ...
0
votes
4answers
169 views

Will uploading a picture from my computer to a site let that site locate my computer or compromise my security?

I have a PC using Windows 7 that I realize should be upgraded. I'm using the Windows Defender antivirus that came with the computer. I recently joined a discussion forum. Member profiles there allow ...
0
votes
3answers
210 views

Is OAuth more secure compared to API Keys

I have worked on many API integrations scenarios, and I used 2 approaches to authenticate the API calls, as follow:- Using API Keys For example inside hubspot integration i use this web call to get ...
3
votes
1answer
125 views

Report-URI CSP Directive

Consider a scenario where CSP is configured in response headers rather than using meta tag. And only one directive is used. Content-Security-Policy: report-uri https://www.example.com Does the above ...
1
vote
1answer
319 views

What are disadvantages of a reverse OTP flow, where OTP is visible on a website and is retyped on authenticated mobile client?

I want to authenticate a user on a 3rd party website (this is more or less an OAuth flow, so this website will be able to perform actions on behalf of my user afterwards, e.g. receive some of her data)...
4
votes
1answer
6k views

XSS not exploitable when POST data is sent in JSON?

There is a reflected XSS flaw in an application I am testing. Initially, the payload is sent in POST request as value of a JSON key and the response is also a JSON object. The returned value in the ...
0
votes
1answer
281 views

XSS cookie Stealing with Character limitations

The rules also Include 1. No jQuery 2. Only through making an API AJAX request. 3.character limitation of 100 characters. Can any suggest me how I can build a payload sticking with these rules.
0
votes
2answers
160 views

Is Link Obscurity as a Security Practice Bad?

I have heard that "Security by Obscurity" is bad. And I have always agreed with it. But today I had a coworker disagree when in consideration of links. He was arguing that a link with ...
0
votes
1answer
146 views

Modsecurity CRS how to deal with field arrays

I have a question how to deal with whitelisting field arrays in modsecurity. Currently am doing the following: ... ctl:ruleRemoveTargetById=942510;ARGS:_owc_pdc_faq_group[0][pdc_faq_answer]" ... ...
0
votes
0answers
23 views

SQL injection into LIMIT in MySQL 8

Given a query such as: SELECT * FROM users limit 1,$limit Is there a way to exploit this when using MySQL 8 and the standard PHP MySQL functions (ie no multi_query)? What I have tried (unsuccessfully)...
1
vote
1answer
2k views

How to bypass sanitization of < while exploiting an XSS vulnerability?

Whatever is to the right of < is being deleted if I don't have a following >, else everything in between < and > is being deleted. Is there a way to bypass this sanitization?
0
votes
1answer
62 views

How to MITM an http website without infiltrating any infrastructure?

There's a certain website designed so that junior QAs learn to find bugs. Trouble is: it's http:// there's no IP filtering users are very junior so they use their real names as user names and ...
0
votes
2answers
79 views

HTTP with encrypted message vs HTTPS

A bit of background: I am a web developer and sometimes i integrate some form of external API in my web applications. It's the second time already that i find something strange: some APIs instead of ...
0
votes
1answer
179 views

Watering Hole Website NTLM Steal Attack

I'm trying to recreate a Watering hole SMB theft attack where you send a victim a link to your website containing code like "file://ip/file.gif" Causing forced authentication which passes ...
0
votes
0answers
16 views

Store login credentials securely with JavaScript [duplicate]

Today I have a web application that needs to store the user's email and password, so that when he opens the login screen, the authentication is done automatically. For this, our application saves the ...
0
votes
1answer
71 views

How to control authorized access to specific data for specific users

I am building a web application that involves a login system. Once a user has logged in and is authenticated they should have the ability to access data from a database. This is however where I get a ...
-1
votes
0answers
50 views

Why do I get some many suspect requests on my webserer?

I maintain about 25 websites for customers and keep all their logs for analysis. Some of those websites get 1000+ clicks daily but do not have issues with weird requests. But now I have registered a ...
2
votes
2answers
5k views

Sql injection bypass against KONA (akamai) WAF

I have been trying to find SQL injection against a site in bug bounty. I tried a few parameters via SQLmap. One such query was shown to be injectible. Parameter: query (GET) Type: boolean-based ...
1
vote
1answer
57 views

Which CSP implementation is more secure?

While implementing CSP, there are two options. Implement CSP in the HTTP response header Implement CSP using a meta tag <meta http-equiv="Content-Security-Policy" content="default-...
-5
votes
4answers
524 views

Should companies use crowd source audit platforms for penetration tests? [closed]

As a CIO, CISO, CTO or Sys Admin, would you use a crowdsourced platform for penetration tests in order to improve your security issues? Google, Facebook, PayPal and other big companies have a Bug ...
3
votes
1answer
367 views

Authentication handshake between two independent apps

I need help on a solution for below scenario from a security perspective. Scenario: There are two independent web applications App1 and App2. User will log in to App1 by performing authentication ...
14
votes
4answers
11k views

Is username enumeration practical when the username is an email address?

From what I understand it is bad security practice to display informative failed login messages like: The email you entered does not exist Instead of Incorrect email/password combination ...
2
votes
1answer
439 views

XSS chained with CSRF = Stored XSS?

I have recently heard that XSS + CSRF = stored XSS. I didn't think too much about it at the time, but now it's bugging me, because it doesn't make too much sense. I would say that it can stand true, ...
2
votes
1answer
137 views

Is this server side object vulnerable to XSS?

I have an object that is stored in the server side of the application. It is never inserted into the DOM. The object looks like this: {"id": "34245425", "field": false, &...
153
votes
4answers
83k views

Why is the same origin policy so important?

I can't really fully understand what same origin domain means. I know it means that when getting a resource from another domain (say a JS file) it will run from the context of the domain that serves ...
149
votes
10answers
84k views

https security - should password be hashed server-side or client-side?

I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords. I am facing a dilemma - I used to think it is safer to make a ...
3
votes
1answer
217 views

Is this XSS filter for HTML comments safe?

HTML comments can be notoriously tricky from an XSS standpoint, and the standard recommendation seems to be to never put untrusted user data in them. But shouldn't it be possible to strip out a few ...
4
votes
1answer
691 views

How to securely store 3rd party API keys directly on web server

I'm building a private web app that I plan to use between myself and a few select friends. Each of us have API keys for a 3rd party service that my web app needs to access so it can call the 3rd party ...
0
votes
2answers
61 views

How big must the random string be and how long should a user activation link be available?

As I see in this answer that cryptographically secure randomness is a must in user activation urls such as: https://example.com/user-activate/^random_string^ But what are considered best practice ...
1
vote
1answer
2k views

Exfiltration through FTP using XXE on a Tomcat server

I'm trying to extract binary data from a Tomcat server that is using SAXParser. For my FTP server, I am using this source. I'm hosting two DTD's on Github Gist. These are their contents: Base XML (...
3
votes
1answer
175 views

Sql map Manual Vulnerability Assessment

I am trying to do penetration testing for one of my client. The platform is Code ignitor. There is an endpoint /find/1 The function queries the vehicle table where vehicle ID is 1 with no sanity check....
1
vote
1answer
521 views

Benefits of placing WAF reverse proxy/transparent in front of web-based honeypots?

For my final year project, I wanted to do a comparative analysis of 2 WAF's ModSec/Shadow Daemon and web-based honeypot SNARE/TANNER. I wanted to find out if there are any benefits of placing WAF ...
0
votes
1answer
119 views

Benefit of Parameter Map size validation in web application controller

I have a web application (Spring MVC) and have input data validation for every parameter in the controller. What is NOT present is checking for accepted Parameter Map Size. i.e When the controller ...
3
votes
4answers
8k views

Can Cross site scripting lead to database access?

I wanna know that weather a site having XSS vulnerability can lead the hacker to access database? I know that he can get the username and password from the cookie stored but can he completely access ...
7
votes
2answers
2k views

Why some applications host the API in a different domain?

I have seen a trend of applications moving their APIs to other domains (from api.application.com to api.applicationapi.com). Two examples: 3.basecampapi.com and api.dropboxapi.com Is there a ...
0
votes
1answer
281 views

SQLi Filter Bypass with banned table/column names

I've studying and practicing different approach to SQLi filter bypass and I faced a challenge. What if the WAF filters look for specific strings rather than SQL keywords? Example: Filter: /UNION/ SQLi:...
2
votes
4answers
189 views

LFI php://input returning initial argument?

TLDR: Trying to execute commands on site thats got a LFI vuln. So I am making my post request to my vulnerable site and import requests header = { 'User-Agent':'Mozilla/5.0 (Windows; U; ...
9
votes
5answers
4k views

Is information disclosure in a form of a server header a real vulnerability?

I have seen in many places that people say that headers of the following types is a vulnerability: Server:Microsoft-IIS/7.5 X-AspNet-Version:4.0.30319 X-Powered-By:ASP.NET I can see that this gives ...
1
vote
1answer
123 views

PCI & e-banking sensitive information tokenization/encryption/obfuscation - Which fields require to be secured?

According to PCI standard all businesses that store, process or transmit payment cardholder data must be PCI Compliant. Taking into account that we are talking about a bank, fields like card number ...
0
votes
0answers
25 views

Local attack vector and other metrics

While calculating the CVSS score using CVSS3.1, attack vectors are classified into four. Network - Remote attack Adjacent - Should share the same Physical or Logical network of victim Physical - ...
1
vote
1answer
107 views

How to secure a code preview function?

Suppose there is an application which contained preview functionality, that means whatever the code (if it is PHP, HTML Python) the user writes, the user can preview the code. For ex: <?php echo &...
2
votes
1answer
168 views

Dangers of using the web applications provided by password managers

The password manager bitwarden requires the user to log in to their account on their web site to allow them to enable 2FA, import passwords and manage other account related details, as that ...
3
votes
3answers
4k views

Allowing user to access password protected website without disclosing the password

A friend of mine has the following problem. She is an accountant and her clients frequently give her their login credentials so she could download their accounting data from various financial ...
0
votes
1answer
80 views

Reverse-proxy issues

I am trying to create a reverse-proxy web application using Flask. I don't really know weather to call it reverse-proxy or not but my idea is that the web app gets a URL from ../proxy/<URL>, ...
51
votes
9answers
5k views

If I include a Forgot Password service, then what's the point of using a password?

I've implemented a Forgot Password service in the following way: User goes to login page, clicks on "Forgot password?" User is presented with a form that asks for their email address. Email is sent ...
0
votes
0answers
56 views

Web Attack Chaining - Follow Up Attack from a Single Vulnerability

I am a blue team security researcher looking into preventing web-based attacks. For manual pentesting, we can tell that a certain vulnerability is likely to be present if another vuln is detected e.g. ...
0
votes
2answers
170 views

Is there an issue if application responds with access control allow origin * but there is no allow credentials header?

Since application is not responding with allow credentials header, an attacker can't craft cross domain request with cookies, but I was wondering if allow origin * alone (Without credentials being ...
50
votes
3answers
39k views

Why is it insecure to store the session ID in a cookie directly?

I am learning about session middleware. You have to supply a secret or the middleware complains: app.use(session({ secret: "abc", resave: false, saveUninitialized: false, store: new ...
0
votes
2answers
472 views

Prevent URL encoding on form submit

During an engagement, I found a potential XSS vulnerability on a page. There is an HTML form that is submitted to this page (POST method) and sent parameters are reflected (without encoding) in the ...
0
votes
1answer
166 views

How apache tomcat favicon can be malicious or cause unintended results in application?

At the moment, there aren't any of those vulnerabilities that we know. I was looking the docs on what damages can be done by hackers if apache tomcat favicon is revealed in web application.

1
2 3 4 5
65